Procedure examples

Winnti for Windows has the ability to encrypt and compress its payload.

Winnti for Windows has the ability to encrypt and compress its payload.

A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.

Winnti for Windows can delete the DLLs for its various components from a compromised host.

Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.

Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.

Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.

Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.

The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.

The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.

Winnti for Windows can communicate using custom TCP.

The Winnti for Windows dropper can place malicious payloads on targeted systems.

Winnti for Windows can use Native API to create a new process and to start services.

The Winnti for Windows dropper can decrypt and decompresses a data blob.

The Winnti for Windows installer loads a DLL using rundll32.

The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.

Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.

Winnti for Windows can use a variant of the sysprep UAC bypass.

Winnti for Windows can run as a service using svchost.exe.

Winnti for Windows can XOR encrypt C2 traffic.